@masheev/better-auth 0.0.0-stage → 1.7.5

package/dist/plugins/one-tap/client.d.mts

@@ -0,0 +1,174 @@
+import { BetterAuthClientOptions, ClientFetchOption, ClientStore } from "@better-auth/core";
+import * as _$_better_fetch_fetch0 from "@better-fetch/fetch";
+import { BetterFetch } from "@better-fetch/fetch";
+
+//#region src/plugins/one-tap/client.d.ts
+declare global {
+  interface Window {
+    googleScriptInitialized?: boolean | undefined;
+  }
+}
+interface GsiButtonConfiguration {
+  /**
+   * The button type: icon, or standard button.
+   */
+  type: "standard" | "icon";
+  /**
+   * The button theme. For example, filled_blue or filled_black.
+   * outline  A standard button theme:
+   * filled_blue  A blue-filled button theme:
+   * filled_black  A black-filled button theme:
+   */
+  theme?: "outline" | "filled_blue" | "filled_black";
+  /**
+   * The button size. For example, small or large.
+   */
+  size?: "small" | "medium" | "large";
+  /**
+   * The button text. The default value is signin_with.
+   * There are no visual differences for the text of icon buttons that
+   * have different text attributes. The only exception is when the
+   * text is read for screen accessibility.
+   *
+   * signin_with  The button text is “Sign in with Google”:
+   * signup_with  The button text is “Sign up with Google”:
+   * continue_with  The button text is “Continue with Google”:
+   * signup_with  The button text is “Sign in”:
+   */
+  text?: "signin_with" | "signup_with" | "continue_with" | "signin";
+  /**
+   * The button shape. The default value is rectangular.
+   */
+  shape?: "rectangular" | "pill" | "circle" | "square";
+  /**
+   * The alignment of the Google logo. The default value is left.
+   * This attribute only applies to the standard button type.
+   */
+  logo_alignment?: "left" | "center";
+  /**
+   * The minimum button width, in pixels. The maximum width is 400
+   * pixels.
+   */
+  width?: number;
+  /**
+   * The pre-set locale of the button text. If it's not set, the
+   * browser's default locale or the Google session user’s preference
+   * is used.
+   */
+  locale?: string;
+  /**
+   * You can define a JavaScript function to be called when the
+   * Sign in with Google button is clicked.
+   */
+  click_listener?: () => void;
+  /**
+   * Optional, as multiple Sign in with Google buttons can be
+   * rendered on the same page, you can assign each button with a
+   * unique string. The same string would return along with the ID
+   * token, so you can identify which button user clicked to sign in.
+   */
+  state?: string;
+}
+interface GoogleOneTapOptions {
+  /**
+   * Google client ID
+   */
+  clientId: string;
+  /**
+   * Auto select the account if the user is already signed in
+   */
+  autoSelect?: boolean | undefined;
+  /**
+   * Cancel the flow when the user taps outside the prompt
+   *
+   * Note: To use this option, disable `promptOptions.fedCM`
+   */
+  cancelOnTapOutside?: boolean | undefined;
+  /**
+   * The mode to use for the Google One Tap flow
+   *
+   * popup: Use a popup window
+   * redirect: Redirect the user to the Google One Tap flow
+   *
+   * @default "popup"
+   */
+  uxMode?: ("popup" | "redirect") | undefined;
+  /**
+   * The context to use for the Google One Tap flow.
+   *
+   * @see {@link https://developers.google.com/identity/gsi/web/reference/js-reference}
+   * @default "signin"
+   */
+  context?: ("signin" | "signup" | "use") | undefined;
+  /**
+   * Additional configuration options to pass to the Google One Tap API.
+   */
+  additionalOptions?: Record<string, any> | undefined;
+  /**
+   * Configuration options for the prompt and exponential backoff behavior.
+   */
+  promptOptions?: {
+    /**
+     * Base delay (in milliseconds) for exponential backoff.
+     * @default 1000
+     */
+    baseDelay?: number;
+    /**
+     * Maximum number of prompt attempts before calling onPromptNotification.
+     * @default 5
+     */
+    maxAttempts?: number;
+    /**
+     * Whether to support FedCM (Federated Credential Management) support.
+     *
+     * @see {@link https://developer.chrome.com/docs/identity/fedcm/overview}
+     * @default true
+     */
+    fedCM?: boolean | undefined;
+  } | undefined;
+}
+interface GoogleOneTapActionOptions extends Omit<GoogleOneTapOptions, "clientId" | "promptOptions"> {
+  fetchOptions?: ClientFetchOption | undefined;
+  /**
+   * Callback URL.
+   */
+  callbackURL?: string | undefined;
+  /**
+   * Optional callback that receives the prompt notification if (or when) the prompt is dismissed or skipped.
+   * This lets you render an alternative UI (e.g. a Google Sign-In button) to restart the process.
+   */
+  onPromptNotification?: ((notification?: any | undefined) => void) | undefined;
+  nonce?: string | undefined;
+  /**
+   * Button mode configuration. When provided, renders a "Sign In with Google" button
+   * instead of showing the One Tap prompt.
+   */
+  button?: {
+    /**
+     * The HTML element or CSS selector where the button should be rendered.
+     * If a string is provided, it will be used as a CSS selector.
+     */
+    container: HTMLElement | string;
+    /**
+     * Button configuration options
+     */
+    config?: GsiButtonConfiguration | undefined;
+  } | undefined;
+}
+declare const oneTapClient: (options: GoogleOneTapOptions) => {
+  id: "one-tap";
+  version: string;
+  fetchPlugins: {
+    id: string;
+    name: string;
+    hooks: {
+      onResponse(ctx: _$_better_fetch_fetch0.ResponseContext): Promise<void>;
+    };
+  }[];
+  getActions: ($fetch: BetterFetch, _$store: ClientStore, _options: BetterAuthClientOptions | undefined) => {
+    oneTap: (opts?: GoogleOneTapActionOptions | undefined, fetchOptions?: ClientFetchOption | undefined) => Promise<void>;
+  };
+  getAtoms($fetch: BetterFetch): {};
+};
+//#endregion
+export { GoogleOneTapActionOptions, GoogleOneTapOptions, GsiButtonConfiguration, oneTapClient };

package/dist/plugins/one-tap/client.mjs

@@ -0,0 +1,208 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { isSafeUrlScheme } from "@better-auth/core/utils/url";
+//#region src/plugins/one-tap/client.ts
+let isRequestInProgress = false;
+function isFedCMSupported() {
+	return typeof window !== "undefined" && "IdentityCredential" in window;
+}
+/**
+* Reasons that should NOT trigger a retry.
+* @see https://developers.google.com/identity/gsi/web/reference/js-reference
+*/
+const noRetryReasons = {
+	dismissed: ["credential_returned", "cancel_called"],
+	skipped: ["user_cancel", "tap_outside"]
+};
+const oneTapClient = (options) => {
+	return {
+		id: "one-tap",
+		version: PACKAGE_VERSION,
+		fetchPlugins: [{
+			id: "fedcm-signout-handle",
+			name: "FedCM Sign-Out Handler",
+			hooks: { async onResponse(ctx) {
+				if (!ctx.request.url.toString().includes("/sign-out")) return;
+				if (options.promptOptions?.fedCM === false || !isFedCMSupported()) return;
+				navigator.credentials.preventSilentAccess();
+			} }
+		}],
+		getActions: ($fetch, _$store, _options) => {
+			return { oneTap: async (opts, fetchOptions) => {
+				if (isRequestInProgress) {
+					console.warn("A Google One Tap request is already in progress. Please wait.");
+					return;
+				}
+				if (typeof window === "undefined" || !window.document) {
+					console.warn("Google One Tap is only available in browser environments");
+					return;
+				}
+				if (opts?.button) {
+					await loadGoogleScript();
+					const container = typeof opts.button.container === "string" ? document.querySelector(opts.button.container) : opts.button.container;
+					if (!container) {
+						console.error("Google One Tap: Button container not found", opts.button.container);
+						return;
+					}
+					async function callback(idToken) {
+						if ((await $fetch("/one-tap/callback", {
+							method: "POST",
+							body: {
+								idToken,
+								callbackURL: opts?.callbackURL
+							},
+							...opts?.fetchOptions,
+							...fetchOptions
+						}))?.error) return;
+						if (!opts?.fetchOptions && !fetchOptions || opts?.callbackURL) {
+							const target = opts?.callbackURL ?? "/";
+							if (isSafeUrlScheme(target)) window.location.href = target;
+						}
+					}
+					const { autoSelect, cancelOnTapOutside, context } = opts ?? {};
+					const contextValue = context ?? options.context ?? "signin";
+					const useFedCM = options.promptOptions?.fedCM !== false;
+					window.google?.accounts.id.initialize({
+						client_id: options.clientId,
+						callback: async (response) => {
+							try {
+								await callback(response.credential);
+							} catch (error) {
+								console.error("Error during button callback:", error);
+							}
+						},
+						auto_select: autoSelect,
+						cancel_on_tap_outside: cancelOnTapOutside,
+						context: contextValue,
+						ux_mode: opts?.uxMode || "popup",
+						nonce: opts?.nonce,
+						itp_support: true,
+						use_fedcm_for_prompt: useFedCM,
+						...options.additionalOptions
+					});
+					window.google?.accounts.id.renderButton(container, opts.button.config ?? { type: "icon" });
+					return;
+				}
+				async function callback(idToken) {
+					if ((await $fetch("/one-tap/callback", {
+						method: "POST",
+						body: {
+							idToken,
+							callbackURL: opts?.callbackURL
+						},
+						...opts?.fetchOptions,
+						...fetchOptions
+					}))?.error) return;
+					if (!opts?.fetchOptions && !fetchOptions || opts?.callbackURL) {
+						const target = opts?.callbackURL ?? "/";
+						if (isSafeUrlScheme(target)) window.location.href = target;
+					}
+				}
+				const { autoSelect, cancelOnTapOutside, context } = opts ?? {};
+				const contextValue = context ?? options.context ?? "signin";
+				isRequestInProgress = true;
+				try {
+					await loadGoogleScript();
+					await new Promise((resolve, reject) => {
+						let isResolved = false;
+						const baseDelay = options.promptOptions?.baseDelay ?? 1e3;
+						const maxAttempts = options.promptOptions?.maxAttempts ?? 5;
+						const useFedCM = options.promptOptions?.fedCM !== false;
+						window.google?.accounts.id.initialize({
+							client_id: options.clientId,
+							callback: async (response) => {
+								isResolved = true;
+								try {
+									await callback(response.credential);
+									resolve();
+								} catch (error) {
+									console.error("Error during One Tap callback:", error);
+									reject(error);
+								}
+							},
+							auto_select: autoSelect,
+							cancel_on_tap_outside: cancelOnTapOutside,
+							context: contextValue,
+							ux_mode: opts?.uxMode || "popup",
+							nonce: opts?.nonce,
+							/**
+							* @see {@link https://developers.google.com/identity/gsi/web/guides/overview}
+							*/
+							itp_support: true,
+							use_fedcm_for_prompt: useFedCM,
+							...options.additionalOptions
+						});
+						const handlePrompt = (attempt) => {
+							if (isResolved) return;
+							window.google?.accounts.id.prompt((notification) => {
+								if (isResolved) return;
+								if (notification.isDismissedMoment?.()) {
+									const reason = notification.getDismissedReason?.();
+									if (noRetryReasons.dismissed.includes(reason)) {
+										opts?.onPromptNotification?.(notification);
+										resolve();
+										return;
+									}
+									if (attempt < maxAttempts) {
+										const delay = Math.pow(2, attempt) * baseDelay;
+										setTimeout(() => handlePrompt(attempt + 1), delay);
+									} else {
+										opts?.onPromptNotification?.(notification);
+										resolve();
+									}
+								} else if (notification.isSkippedMoment?.()) {
+									const reason = notification.getSkippedReason?.();
+									if (!reason || noRetryReasons.skipped.includes(reason)) {
+										opts?.onPromptNotification?.(notification);
+										resolve();
+										return;
+									}
+									if (attempt < maxAttempts) {
+										const delay = Math.pow(2, attempt) * baseDelay;
+										setTimeout(() => handlePrompt(attempt + 1), delay);
+									} else {
+										opts?.onPromptNotification?.(notification);
+										resolve();
+									}
+								} else if (notification.isNotDisplayed?.()) {
+									opts?.onPromptNotification?.(notification);
+									resolve();
+								}
+							});
+						};
+						handlePrompt(0);
+					});
+				} catch (error) {
+					console.error("Error during Google One Tap flow:", error);
+					throw error;
+				} finally {
+					isRequestInProgress = false;
+				}
+			} };
+		},
+		getAtoms($fetch) {
+			return {};
+		}
+	};
+};
+const loadGoogleScript = () => {
+	return new Promise((resolve, reject) => {
+		if (window.googleScriptInitialized) {
+			resolve();
+			return;
+		}
+		const script = document.createElement("script");
+		script.src = "https://accounts.google.com/gsi/client";
+		script.async = true;
+		script.defer = true;
+		script.onload = () => {
+			window.googleScriptInitialized = true;
+			resolve();
+		};
+		script.onerror = () => {
+			reject(/* @__PURE__ */ new Error("Failed to load Google Identity Services script"));
+		};
+		document.head.appendChild(script);
+	});
+};
+//#endregion
+export { oneTapClient };

package/dist/plugins/one-tap/index.d.mts

@@ -0,0 +1,82 @@
+import * as _$better_call0 from "better-call";
+import * as z from "zod";
+
+//#region src/plugins/one-tap/index.d.ts
+declare module "@better-auth/core" {
+  interface BetterAuthPluginRegistry<AuthOptions, Options> {
+    "one-tap": {
+      creator: typeof oneTap;
+    };
+  }
+}
+interface OneTapOptions {
+  /**
+   * Disable the signup flow
+   *
+   * @default false
+   */
+  disableSignup?: boolean | undefined;
+  /**
+   * Google Client ID
+   *
+   * If a client ID is provided in the social provider configuration,
+   * it will be used.
+   */
+  clientId?: string | undefined;
+}
+declare const oneTap: (options?: OneTapOptions | undefined) => {
+  id: "one-tap";
+  version: string;
+  endpoints: {
+    oneTapCallback: _$better_call0.StrictEndpoint<"/one-tap/callback", {
+      method: "POST";
+      body: z.ZodObject<{
+        idToken: z.ZodString;
+        callbackURL: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>;
+      metadata: {
+        openapi: {
+          summary: string;
+          description: string;
+          responses: {
+            200: {
+              description: string;
+              content: {
+                "application/json": {
+                  schema: {
+                    type: "object";
+                    properties: {
+                      session: {
+                        $ref: string;
+                      };
+                      user: {
+                        $ref: string;
+                      };
+                    };
+                  };
+                };
+              };
+            };
+            400: {
+              description: string;
+            };
+          };
+        };
+      };
+    }, {
+      token: string;
+      user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined;
+      };
+    }>;
+  };
+  options: OneTapOptions | undefined;
+};
+//#endregion
+export { OneTapOptions, oneTap };

package/dist/plugins/one-tap/index.mjs

@@ -0,0 +1,100 @@
+import { parseUserOutput } from "../../db/schema.mjs";
+import { setSessionCookie } from "../../cookies/index.mjs";
+import { OAUTH_CALLBACK_ERROR_CODES } from "../../oauth2/errors.mjs";
+import { handleOAuthUserInfo } from "../../oauth2/link-account.mjs";
+import { APIError as APIError$1 } from "../../api/index.mjs";
+import { PACKAGE_VERSION } from "../../version.mjs";
+import { toBoolean } from "../../utils/boolean.mjs";
+import { BASE_ERROR_CODES } from "@better-auth/core/error";
+import { isGoogleHostedDomainAllowed, verifyGoogleIdToken } from "@better-auth/core/social-providers";
+import { createAuthEndpoint } from "@better-auth/core/api";
+import * as z from "zod";
+//#region src/plugins/one-tap/index.ts
+const oneTapCallbackBodySchema = z.object({
+	idToken: z.string().meta({ description: "Google ID token, which the client obtains from the One Tap API" }),
+	/**
+	* Sent so the global origin-check middleware validates the post-login
+	* redirect target against `trustedOrigins`. Without it the client performs
+	* an unvalidated `window.location` redirect, which is an open redirect.
+	*/
+	callbackURL: z.string().meta({ description: "URL to redirect to after a successful sign-in" }).optional()
+});
+const oneTap = (options) => ({
+	id: "one-tap",
+	version: PACKAGE_VERSION,
+	endpoints: { oneTapCallback: createAuthEndpoint("/one-tap/callback", {
+		method: "POST",
+		body: oneTapCallbackBodySchema,
+		metadata: { openapi: {
+			summary: "One tap callback",
+			description: "Use this endpoint to authenticate with Google One Tap",
+			responses: {
+				200: {
+					description: "Successful response",
+					content: { "application/json": { schema: {
+						type: "object",
+						properties: {
+							session: { $ref: "#/components/schemas/Session" },
+							user: { $ref: "#/components/schemas/User" }
+						}
+					} } }
+				},
+				400: { description: "Invalid token" }
+			}
+		} }
+	}, async (ctx) => {
+		const { idToken } = ctx.body;
+		const googleProvider = typeof ctx.context.options.socialProviders?.google === "function" ? await ctx.context.options.socialProviders?.google() : ctx.context.options.socialProviders?.google;
+		const audience = options?.clientId || googleProvider?.clientId;
+		if (!audience || Array.isArray(audience) && audience.length === 0) throw new APIError$1("BAD_REQUEST", { message: "Google client ID is required for One Tap. Set it on the oneTap plugin (clientId) or on socialProviders.google." });
+		const payload = await verifyGoogleIdToken({
+			token: idToken,
+			audience
+		});
+		if (!payload) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+		if (!payload.sub) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+		const configuredHostedDomain = googleProvider?.hd;
+		if (!isGoogleHostedDomainAllowed(configuredHostedDomain, payload.hd)) {
+			ctx.context.logger.error(`Google One Tap sign-in rejected: id token hosted domain (hd) "${payload.hd ?? "<missing>"}" does not satisfy the configured "hd" option "${configuredHostedDomain}".`);
+			throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+		}
+		const { email: rawEmail, email_verified, name, picture, sub } = payload;
+		if (typeof rawEmail !== "string" || !rawEmail) throw new APIError$1("BAD_REQUEST", { message: "Email not available in token" });
+		if (typeof sub !== "string" || !sub) throw new APIError$1("BAD_REQUEST", { message: "invalid id token" });
+		const result = await handleOAuthUserInfo(ctx, {
+			userInfo: {
+				id: sub,
+				email: rawEmail.toLowerCase(),
+				emailVerified: typeof email_verified === "boolean" ? email_verified : toBoolean(email_verified),
+				name: typeof name === "string" ? name : "",
+				image: typeof picture === "string" ? picture : void 0
+			},
+			account: {
+				providerId: "google",
+				accountId: sub,
+				idToken,
+				scope: "openid,profile,email"
+			},
+			disableSignUp: options?.disableSignup || googleProvider?.disableSignUp,
+			source: {
+				method: "oauth",
+				oauth: {
+					providerId: "google",
+					profile: payload
+				}
+			}
+		});
+		if (result.error) {
+			if (result.error === OAUTH_CALLBACK_ERROR_CODES.EMAIL_NOT_VERIFIED) throw APIError$1.from("FORBIDDEN", BASE_ERROR_CODES.EMAIL_NOT_VERIFIED);
+			throw new APIError$1("UNAUTHORIZED", { message: result.error });
+		}
+		await setSessionCookie(ctx, result.data);
+		return ctx.json({
+			token: result.data.session.token,
+			user: parseUserOutput(ctx.context.options, result.data.user)
+		});
+	}) },
+	options
+});
+//#endregion
+export { oneTap };

package/dist/plugins/one-time-token/client.d.mts

@@ -0,0 +1,10 @@
+import { OneTimeTokenOptions, oneTimeToken } from "./index.mjs";
+
+//#region src/plugins/one-time-token/client.d.ts
+declare const oneTimeTokenClient: () => {
+  id: "one-time-token";
+  version: string;
+  $InferServerPlugin: ReturnType<typeof oneTimeToken>;
+};
+//#endregion
+export { oneTimeTokenClient };

package/dist/plugins/one-time-token/client.mjs

@@ -0,0 +1,11 @@
+import { PACKAGE_VERSION } from "../../version.mjs";
+//#region src/plugins/one-time-token/client.ts
+const oneTimeTokenClient = () => {
+	return {
+		id: "one-time-token",
+		version: PACKAGE_VERSION,
+		$InferServerPlugin: {}
+	};
+};
+//#endregion
+export { oneTimeTokenClient };